English | 简体中文

Vapor — Distributed Steam Automation Control Plane

API-controlled, headless Steam automation platform designed for large-scale batch operations and multi-region deployment. Inspired by ArchiSteamFarm's Bot/Action model.

The Steam protocol layer is built on SteamKit2; the product shape reuses ASF's bot-session concepts in a control-plane / agent split instead of one process per machine. One control plane can steer agents in every region, close to Steam's regional endpoints. Agents reach the control plane, never the other way around.

Highlights

Each account runs as a persistent Steam bot session: credential login with token refresh, SteamGuard / 2FA challenges, TOTP and QR-code login, and .maFile import from SDA or steamguard-cli. On top of that sit 65 actions — card farming, playtime boosting, trade offers, market listings with fee-aware pricing, inventory and duplicate scanning, achievement management, key redemption, free-license and points-shop claims, plus the Dota 2 trading plugin. Every action carries an execution-safety class, which is what lets the scheduler cap redispatch at 2 attempts for actions whose repetition can double an external side effect, while read-only and idempotent actions keep the configured ceiling. The actions catalog lists every payload field.

Declarative orchestration: you state online / idle / farm / boost per account and the reconciler converges reality to that statement, rotating farming targets as card drops run out and reassigning accounts when an agent disappears. GET /v1/orchestration/farm shows the live loop.

Risky surfaces ship disabled. Market listing creation and cancels default to dry_run and need both a per-account and a per-agent switch; trade auto-accept requires an explicit per-account policy with a partner whitelist and gifts-only mode. Every one of those decisions lands in the audit log.

Plugins load into isolated AssemblyLoadContexts and unload without a restart. Manifests carry a SemVer API contract, a trust level and permission grants; the runtime PluginStore installs packages agent-targeted from a catalog. Seven official plugins ship in-tree: Monitoring, MobileAuthenticator, MarketWatch, CS2/CSGO, Dota 2, GameData, GameAccess — the last carrying the game-access action surface as a wire-compatible extraction from the host. See plugin development.

For operations: a control-plane script repository to store and dispatch operator scripts to connected agents plus ordered script flows (sequential steps, per-step status, stop/continue failure policy), OpenAPI/Swagger, SSE event streams (jobs, sessions, auth challenges), Prometheus metrics with a Grafana dashboard, OpenTelemetry tracing across the agent tunnel, HMAC-signed webhooks, and structured logs that redact credentials and codes at output. Security posture is AES-GCM encrypted credential stores with key rotation tooling, per-role API keys, and an audit log redacted at rest — under one hard rule: Steam Guard codes and credentials never leave the agent, only a boolean crosses the wire.

Architecture at a glance

                    ┌────────────────────────────────────────────┐
                    │               Control Plane                │
   operators ──────▶│  REST /v1 (68 routes / 84 ops) · OpenAPI·SSE│
   (curl / UI)      │  SQLite: jobs · accounts · audit · crawl · scripts │
                    │  DesiredStateReconciler · schedulers       │
                    │  admin.html · dashboard.html · gamedata    │
                    └───────────────┬────────────────────────────┘
                                    │ outbound WSS tunnel (agent key)
                    ┌───────────────┴──────────┐  ┌──────────────┐
                    │         Agent #1         │  │   Agent #N   │   ← one per region
                    │  session engine (bots)   │  │              │
                    │  65 actions · plugins   │  │   plugins    │
                    │  encrypted credentials   │  │              │
                    └───────────────┬──────────┘  └──────┬───────┘
                                    │                    │
                                    ▼                    ▼
                               Steam network       Steam network

Live demo

Demo site https://vapor.cuihairu.site/ | demo account demo / demo-899d0e86ad4d1c524da9c47a9d0f160e (for trial use, data resets periodically)

• The demo key is a dedicated read-only sandbox: it authenticates reads (GET/HEAD) on the REST API and both consoles, while every write — job creation, account changes, agent dispatch — is rejected with 401. The real admin key lives only on the deploy machine and is never published.
• Sign-in: open /admin.html (admin console) or /dashboard.html (read-only dashboard) and paste the demo password into the API-key prompt.
• Deployed by CI straight from main: deploys happen only when the full test gate (all-green suite + 100% line/branch coverage) and the image build are green, with automatic rollback on failure. Demo data is reset on every deploy — a demo agent stays connected and seeded demo accounts/jobs keep the consoles populated.
• The demo account exists for demonstration only (it is not a real admin account); never enter real Steam credentials into the demo instance.

Preview

Control plane console	Account overview
Job history	Live event stream

Quick start

Docker Compose (control plane + one agent):

git clone https://github.com/cuihairu/vapor.git
cd vapor
docker compose up -d                                # + --profile observability for Prometheus/Grafana
curl -s http://127.0.0.1:8080/healthz

Declare an account and run your first job (dev key defaults, see docker.md for the variable table):

curl -sS -X PUT http://127.0.0.1:8080/v1/accounts/acct-1 \
  -H "Authorization: Bearer admin-dev-token" -H "Content-Type: application/json" \
  -d '{"enabled":true,"desiredState":"Online","region":"eu-west","agentId":"agent-1","updatedBy":"quickstart"}'

curl -sS -X POST http://127.0.0.1:8080/v1/jobs \
  -H "Authorization: Bearer admin-dev-token" -H "Content-Type: application/json" \
  -d '{"action":"ping","region":"eu-west","targets":["acct-1"]}'

Then open the consoles: /admin.html (full management UI) · /dashboard.html (read-first, one whitelisted reconcile action) · /gamedata.html (game data dictionary). The full walkthrough — login, challenges, farming, plugins — is in docs/getting-started.md.

Local test policy

CI and local development branch three ways by change surface — a one-line docs edit should not compile the world.

1. Docs changes (*.md, docs/**, images): no compile. The main CI workflow's paths-ignore already skips these paths.
2. Code changes: run only the affected subset, not the world.
   • dotnet test <changed csproj>
3. Full run (dotnet test -c Release): only triggered by — *.csproj / *.sln, .github/**, Docker/Compose config, and pre-release.

Documentation

Section	Contents
Getting started	Walkthrough · Local run · Docker & Compose · Production deployment
Reference	REST API · Actions catalog · Data dictionary · Performance · Dependency policy · Releasing
Design	Architecture · Domain model · Consistency model · Session engine · Plugin development ·

Requirements

• Runtime: .NET 10 (apps/tests target net10.0)
• SDK: 10.x (recommended)
• Language: C# (via Directory.Build.props)

Testing

• Run tests: ./scripts/run-tests.sh (or pwsh ./scripts/run-tests.ps1)
• Coverage: ./scripts/run-tests.sh --coverage; full-solution gate runs use ./scripts/collect-coverage-serial.sh (per-project collection with report validation)
• Tests require the .NET 10 runtime; DOTNET_ROLL_FORWARD=Major can bridge an older runtime.

Releases

• Versions: SemVer tags vX.Y.Z (see docs/releasing.md)
• Changelog: CHANGELOG.md

Development status

Vapor is currently alpha (breaking changes expected).

License

Apache-2.0, see LICENSE.

Contributing

See CONTRIBUTING.md and SECURITY.md.

Support

See SUPPORT.md.